Most recent entries from all

ALSA-2020:4751 — Moderate: httpd:2.4 security, bug fix, and enhancement update

Affected: AlmaLinux:8: mod_md

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

The following packages have been upgraded to a later upstream version: mod_http2 (1.15.7). (BZ#1814236)

Security Fix(es):

* httpd: memory corruption on early pushes (CVE-2019-10081)

* httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)

* httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)

* httpd: mod_rewrite configurations vulnerable to open redirect (CVE-2020-1927)

* httpd: mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)

* httpd: mod_http2: read-after-free on a string compare (CVE-2019-0196)

* httpd: mod_http2: possible crash on late upgrade (CVE-2019-0197)

* httpd: limited cross-site scripting in mod_proxy error page (CVE-2019-10092)

* httpd: mod_rewrite potential open redirect (CVE-2019-10098)

* httpd: mod_proxy_ftp use of uninitialized value (CVE-2020-1934)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2019-02559

Withdrawn: BELL-CVE-2019-0196 — CVE-2019-0196 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2019-avi-141 — De multiples vulnérabilités ont été découvertes dans Apache Httpd. Certaines d'entre elles permettent à un attaquant de…

certfr-2019-avi-141

cnvd-2019-08942

EUVD-2026-48362

fkie_cve-2019-0196

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.

GHSA-vqc7-p7p7-97wf

gsd-2019-0196

openSUSE-SU-2019:1209-1 — Security update for apache2

Security update for apache2

RHSA-2019:3932 — Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6

openssl: timing side channel attack in the DSA signature algorithm openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) httpd: mod_http2: DoS via slow, unneeded request bodies httpd: mod_session_cookie does not respect expiry time httpd: mod_http2: read-after-free on a string compare httpd: mod_http2: possible crash on late upgrade httpd: mod_auth_digest: access control bypass due to race condition HTTP/2: large amount of data requests leads to denial of service HTTP/2: flood using PRIORITY frames results in excessive resource consumption HTTP/2: 0-length headers lead to denial of service HTTP/2: request for large response leads to denial of service

SUSE-SU-2019:0873-1 — Security update for apache2

Security update for apache2

UBUNTU-CVE-2019-0196

Affected: Ubuntu:18.04:LTS: apache2

WID-SEC-W-2023-2047 — Apache HTTP Server: Mehrere Schwachstellen

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen im Apache HTTP Server ausnutzen, um seine Rechte zu erweitern, Sicherheitsrestriktionen zu umgehen oder um einen Denial of Service Angriff durchzuführen.